BLKSTAT(1)

💅 BLKSTAT — the manual, but make it cute

okay bestie, welcome to blkstat(1), straight outta the General Commands Manual section. this one's a little tool that 👏 tells 👏 you 👏 what's up with one specific data unit on a file system. block? sector? we're checking its vibe. no cap.

✨ NAME ✨

blkstat — displays the details of a file system data unit (i.e. a block or a sector). it's giving microscope energy 🔬

🦋 SYNOPSIS 🦋

blkstat [-f fstype ] [-i imgtype] [-o imgoffset] [-b dev_sector_size]
[-vV] image [images] addr

🌸 DESCRIPTION 🌸

so here's the tea ☕ — blkstat shows you the allocation status of the data unit you point it at. that's it. that's the whole gig. iconic, honestly.

fun little history moment 🎀: back in TSK versions prior to 3.0.0, this exact tool was called dstat. so if you're reading ancient docs like "where is dstat bestie", it's literally the same girl. she just rebranded. main character glow-up fr fr. 💖

🎀 ARGUMENTS 🎀

here's where you tell her what to look at. every flag, every value, no skips, periodt.

• -f fstype — pick the file system type, bestie. and hey, if you don't know your options, run -f list and she'll show you every supported file system type. if you don't pass this at all? autodetection methods get used. she'll figure it out 🕵️‍♀️
• -i imgtype — this one identifies the type of image file, like raw for example. curious what's supported? -i list gives you the whole menu 📋. skip it and again, autodetection methods are used.
• -o imgoffset — the sector offset where the file system actually starts inside the image. lowkey important when your fs isn't sitting right at the beginning.
• -b dev_sector_size — the size, in bytes, of the underlying device sectors. if you don't give her one, she uses the value in the image format (if it exists) or just assumes 512 bytes. default queen 👑
• -v — verbose output of debugging statements, dumped to stderr. loud and proud, we love a chatty girl 💬
• -V — displays the version. that's it. she'll tell you who she is.
• image [images] — the disk or partition image you want to read, whose format you already told her with -i. and yes, you can pass multiple image file names if the image got split into multiple segments 🧩. bonus: if you only give her one image file and its name is the first in a sequence (like, you know, when it ends in .001), the subsequent image segments get included automatically. she's got you 🫶
• addr — the address to display stats on. heads up: this is a fragment for UNIX file systems, or a sector for FAT. know which one you're in, iykyk 💅

👑 AUTHOR 👑

Brian Carrier <carrier at sleuthkit dot org> — legend behavior, honestly.

Send documentation updates to <doc-updates at sleuthkit dot org> 📬 (yes, they want your doc glow-ups, contribute bestie!)

real talk: don't guess at behavior here — if you're unsure about a flag, run -f list or -i list and let the tool tell you. that's not me being vague, that's literally what the manual says. ✨

and that's the whole page, bestie!! 🎉 this was BLKSTAT(1) from the General Commands Manual — footer's just her name again because she's that girl, no version number, no date, just BLKSTAT(1) holding the whole thing down. go check some blocks. slay. 💖✨🎀🦋🌸💅🫶